Ethical Hacking News
The Lazarus Group has been attributed to a sophisticated cyber attack dubbed Operation FlashHole, which targets at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. The group's attack mechanism involves sending spear-phishing emails with links to fabricated but relevant sites, exploiting a security flaw in INISAFE CrossWeb EX, a mandatory financial security software program. The malware deployed by the group includes advanced tools such as Cubridge, which serves as a conduit for other malware families, and TouchHub, which downloads from GitHub and leverages DLL sideloading to launch a rogue DLL payload. The group's use of post-quantum encryption, including ML-KEM-1024, makes its malware communications more resilient to future quantum threats.
The Lazarus Group, linked to North Korea, carried out Operation FlashHole, targeting at least three organizations in South Korea. The attack mechanism involves spear-phishing emails with links to malicious sites, exploiting a security flaw in INISAFE CrossWeb EX. The exploit launches the ThreatNeedle backdoor and incorporates a one-day vulnerability in Innorix Agent file transfer solution. Operation FlashHole continues the targeting of South Korea-focused software, abusing INISAFE CrossWeb EX. The Lazarus Group has a history of abusing this software to deploy malware, including the Racket and DeathNote campaigns. The group's attack mechanism involves a complex infection chain, using DLL sideloading to launch malware payloads. The malware includes Cubridge, an orchestration component, and TouchHub, an advanced version of CLOUDBURST. TouchHub and ClientHub are used to deliver keyloggers, screenshot utilities, and backdoors, with the end goal of deploying additional plugins and DLLs. The malware also uses ML-KEM-1024, a post-quantum cryptographic algorithm, to establish an encrypted connection with the attackers' server.
The Lazarus Group, a North Korea-linked cyber espionage group, has been attributed to a sophisticated cyber attack dubbed Operation FlashHole, which targets at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up from where Operation SyncHole left off.
The Lazarus Group's attack mechanism involves sending spear-phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target. Once a victim clicks on the link, the group exploits a security flaw in INISAFE CrossWeb EX, a mandatory financial security software program installed by South Korean internet users on their computers to support security software across various browser environments when accessing online banking and government services.
The exploit was designed to launch the legitimate "SyncHost.exe" process and inject shellcode into it to load the ThreatNeedle backdoor. The attack chain also incorporated a one-day vulnerability in the Innorix Agent file transfer solution version 9.2.18.496 for lateral movement. This vulnerability allows the attackers to gain persistence on the victim's system, making it easier to deploy further malware.
Operation FlashHole continues the prior wave's targeting of South Korea-focused software to breach targets. Where SyncHole exploited Cross EX, FlashHole has been found to abuse Initech's INISAFE CrossWeb EX, another mandatory financial security solution necessary to access online banking and government portals in the country.
The Lazarus Group has a long history of abusing this software to meet its goals. In Q3 2021, it was used to deploy a downloader named Racket in connection with a long-running campaign called DeathNote. The group has also exploited other vulnerabilities in South Korean security software, including a security flaw in the software to distribute DLL malware (SCSKAppLink.dll) via watering hole attacks.
The group's attack mechanism involves a complex infection chain, where the attackers send spear-phishing emails containing links to malicious sites, which triggers an infection sequence involving CrossWeb EX to launch the legitimate Windows binary "fsquirt.exe," which is then used to launch a malicious DLL called TechHub via DLL sideloading.
TechHub, for its part, downloads from GitHub a malware called TouchHub, which leverages a DLL sideloading a second to launch a rogue DLL payload dubbed TOUCHSHIFT (mscoree.dll) for setting up persistence by kicking off the in-memory execution of another TechHub instance. Overlaps between Lazarus Group Attacks This second TechHub instance retrieves another malware family known as ClientHub to download and load LPEClient into memory.
LPEClient serves as a conduit for Cubridge, the orchestration component of the malware framework designed to fetch various plugins, modules, and tools. Additional details about the malware toolset include TechHub, an advanced version of the CLOUDBURST and NickelLoader downloader that communicates with GitHub to fetch additional payloads like TouchHub and ClientHub, as well as collect information about the device and its running processes.
Cubridge, an improved version of SIDESHOW and LightlessCan, capable of communicating with a command-and-control (C2) server and downloading reusable plugins, DLL utilities for one-off tasks, and additional modules to expand its functionality, thereby allowing it to gather comprehensive system information, run commands, and steal files and web browser data. It's also assessed to be an advanced version of CookiePlus.
TouchHub, a parent installer for TouchShift. TouchShift, a malware dropper capable of delivering keyloggers, screenshot utilities, and backdoors, ClientHub, a previously undocumented backdoor that comes in two versions: one that communicates with an attacker-controlled server, using HTTPS and another that interacts with the Dropbox API.
The end goal of the malware is to deploy additional plugins and DLLs. LPEClient, a longstanding victim profiling and payload delivery tool used since 2019. In August 2026, Check Point revealed that LPEClient was deployed following the zero-day exploitation of CVE-2026-68820, a privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock, to deploy the FudModule rootkit.
The latest version of the malware is notable for its use of ML-KEM-1024, a post-quantum cryptographic algorithm, to establish an encrypted connection with the attackers' server before downloading and running additional malware directly in memory. According to Kaspersky, Operation FlashHole is the latest wave in the broader Cascade Hole campaign, which involves the use of South Korean software as a potential entry point to deliver malware targeting the country.
The emergence of Operation FlashHole coincided with a fresh wave of attacks targeting various South Korean organizations using the COPPERHEDGE backdoor. In at least one case, the backdoor infection is said to have resulted in the exfiltration of data to a dark web leak site named ULOSE, in a manner similar to Gunra ransomware attacks directed against South Korean entities around the same time.
Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs. "What deserves closer attention is Lazarus's adoption of cryptography designed to withstand future quantum threats," said Sojun Ryu, senior security researcher at Kaspersky GReAT. "Our findings trace its use back to at least September 2024, showing that these capabilities were already protecting the group's malware communications more than a year before this disclosure."
Related Information:
https://www.ethicalhackingnews.com/articles/Lazarus-Abuses-South-Korean-Security-Software-to-Deploy-Malware-Using-Post-Quantum-Encryption-ehn.shtml
https://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.html
https://www.socinvestigation.com/comprehensive-list-of-apt-threat-groups-motives-and-attack-methods/
https://cybergeodigest.com/resources/apt-groups-tracker.html
https://securityaffairs.com/172221/apt/lazarus-apt-targeted-employees-unnamed-nuclear-related-org.html
https://thehackernews.com/2024/12/lazarus-group-spotted-targeting-nuclear.html
https://www.ransomware.live/group/gunra
https://dailysecurityreview.com/resources/threat-actors-resources/gunra-ransomware-tactics-victims-and-threat-intelligence/
https://apt.etda.or.th/cgi-bin/listgroups.cgi?t=FudModule
https://ctiwatch.com/threats/TOUCHSHIFT
https://apt.etda.or.th/cgi-bin/listgroups.cgi?t=TOUCHSHIFT&n=1
https://en.wikipedia.org/wiki/Advanced_persistent_threat
https://andreacristaldi.github.io/APTmap/
Published: Tue Oct 27 08:14:50 2026 by llama3.2 3B Q4_K_M
